Merge next into main for "next" release prep

[data-douser]

Summary of Changes

Merges the changes from the next branch -- and from the series of v2.25.1-next.* and v2.25.2-next.* releases -- into the main branch in preparation for integration into the v2.25.3 release.

Outline of Changes

Client migration and documentation updates:

• Removed outdated JavaScript client instructions (client/src/**/*.js) and replaced them with new Go client instructions for client/**/*.go, emphasizing modern Go practices, TDD, and the use of the .tmp/ directory for temp files. [1] [2]
• Updated all developer and agent skill documentation to reference the Go client (gh-ql-mcp-client) for integration testing, tool validation, and manual testing, replacing references to the old JS client. [1] [2] [3]

Continuous Integration and workflow improvements:

• Renamed and restructured the CI workflow file to build-and-test-client.yml, splitting out build/lint/unit test steps for the Go client and updating integration test jobs to use the Go client, not the JS client. [1] [2] [3]
• Updated workflow triggers and job dependencies to ensure proper sequencing and coverage for both push and pull request events.

Testing and integration test process:

• Updated integration test instructions and prompts to use the Go client and new Makefile targets, clarifying how to run tests in both HTTP and stdio modes.
• Changed integration test requirements to use make -C client test and test-config.json for test arguments, aligning with the Go client's test runner.

Dependency and environment updates:

• Upgraded the devcontainer Node image to version 25 and the default Go version to 1.25 for consistency with the updated toolchain. [1] [2]

Minor documentation fixes:

• Updated references to workflow job names and file paths for clarity and accuracy.

These changes collectively ensure that all development, testing, and CI processes use the new Go-based client, streamline developer onboarding, and improve reliability and consistency across environments.

[github-actions]

Dependency Review

The following issues were found:

• ✅ 0 vulnerable package(s)
• ✅ 0 package(s) with incompatible licenses
• ✅ 0 package(s) with invalid SPDX license definitions
• ⚠️ 11 package(s) with unknown licenses.
• ⚠️ 1 packages with OpenSSF Scorecard issues.

View full job summary

[Copilot]

Pull request overview

Merges next into main to prepare for the v2.25.3 release, including the migration from the legacy JS integration-test client to the new Go-based gh-ql-mcp-client, plus related CI/docs updates.

Changes:

• Replace the legacy JS client with a Go CLI (gh-ql-mcp-client) and update integration test workflows/fixtures accordingly.
• Enable annotation/audit/cache tools by default and update server + VS Code extension behavior/tests/docs to match.
• Extend CodeQL CLI tooling (notably codeql_query_compile) and tighten log-directory validation.

Show a summary per file

File	Description
server/test/src/tools/codeql/search-ql-code.test.ts	Adds test coverage for runtime changes to scan-exclude env var handling.
server/test/src/tools/codeql/query-compile.test.ts	Adds unit tests for codeql_query_compile tool definition/schema.
server/test/src/tools/cache-tools.test.ts	Updates tool registration tests for always-on cache tools.
server/test/src/tools/audit-tools.test.ts	Updates tool registration tests for always-on audit tools.
server/test/src/tools/annotation-tools.test.ts	Updates tool registration tests for always-on annotation tools.
server/test/src/lib/log-directory-manager.test.ts	Adds regression coverage for logDir base-prefix edge case.
server/src/types/monitoring.ts	Changes enableAnnotationTools default + semantics comment.
server/src/tools/codeql/search-ql-code.ts	Re-reads scan exclude dirs per call instead of caching at module load.
server/src/tools/codeql/query-compile.ts	Adds dump-dil/logDir inputs and updates tool description/examples.
server/src/tools/cache-tools.ts	Removes opt-in gating so cache tools are always registered.
server/src/tools/audit-tools.ts	Removes opt-in gating so audit tools are always registered.
server/src/tools/annotation-tools.ts	Removes opt-in gating so annotation tools are always registered.
server/src/resources/server-tools.md	Updates SARIF tools table and workflow ordering.
server/src/lib/session-data-manager.ts	Defaults ENABLE_ANNOTATION_TOOLS to true.
server/src/lib/log-directory-manager.ts	Switches base-dir containment check to path.relative() logic.
server/src/lib/cli-tool-registry.ts	Adds default --dump-dil behavior and persists DIL output for query compile.
server/scripts/extract-test-databases.sh	Optimizes default DB extraction scope for integration tests.
server/ql/go/tools/test/PrintAST/go.mod	Minor formatting adjustment.
server/ql/go/tools/test/CallGraphTo/go.mod	Adds go directive.
server/ql/go/tools/test/CallGraphFromTo/go.mod	Adds go directive.
server/ql/go/tools/test/CallGraphFrom/go.mod	Adds go directive.
server/package.json	Bumps minimum Node engine version.
server/README.md	Updates Node prerequisite version.
package.json	Removes client workspace; updates build/lint/test scripts to use make -C client.
extensions/vscode/test/suite/mcp-tool-e2e.integration.test.ts	Updates expected default tool surface (annotation/audit/cache now present).
extensions/vscode/test/bridge/environment-builder.test.ts	Updates env expectations after removing annotation-tools opt-in setting.
extensions/vscode/src/bridge/environment-builder.ts	Stops setting ENABLE_ANNOTATION_TOOLS; keeps default storage location behavior.
extensions/vscode/package.json	Bumps VS Code/Node engines; removes codeql-mcp.enableAnnotationTools setting.
extensions/vscode/README.md	Updates VS Code and Node prerequisites.
docs/testing.md	Updates testing-layer docs to use the Go client and new commands.
docs/public.md	Updates Node minimum version in public docs.
docs/getting-started.md	Updates Node minimum version.
client/src/lib/validate-source-root.js	Removes legacy JS client implementation.
client/src/lib/test-logger.js	Removes legacy JS client implementation.
client/src/lib/server-manager.js	Removes legacy JS client implementation.
client/src/lib/resolve-all-queries.js	Removes legacy JS client implementation.
client/src/lib/queries-filter-metadata.js	Removes legacy JS client implementation.
client/src/lib/process-query-metadata.js	Removes legacy JS client implementation.
client/src/lib/mcp-test-suite.js	Removes legacy JS client implementation.
client/src/lib/mcp-client-utils.js	Removes legacy JS client implementation.
client/src/lib/file-utils.js	Removes legacy JS client implementation.
client/src/lib/commands/metadata-commands.js	Removes legacy JS client implementation.
client/src/lib/commands/basic-commands.js	Removes legacy JS client implementation.
client/src/lib/command-handler.js	Removes legacy JS client implementation.
client/src/lib/cli-parser.js	Removes legacy JS client implementation.
client/src/lib/aggregate-query-metadata.js	Removes legacy JS client implementation.
client/scripts/start-server.sh	Aligns server tmp base with Go client integration-test expectations.
client/scripts/run-integration-tests.sh	Updates orchestration for Go client + new default tool surface.
client/package.json	Removes JS client package manifest.
client/main.go	Adds Go CLI entrypoint.
client/internal/mcp/client_test.go	Adds unit tests for MCP client timeouts/close behavior.
client/internal/github/types.go	Adds typed GitHub Code Scanning API models.
client/internal/github/client_test.go	Adds tests for GitHub client helpers/types.
client/internal/github/client.go	Adds GitHub Code Scanning REST client wrapper.
client/integration-tests/primitives/tools/sarif_diff_by_commits/line_level_classification/test-config.json	Adds Go-runner style integration test config for sarif_diff_by_commits (line).
client/integration-tests/primitives/tools/sarif_diff_by_commits/line_level_classification/before/results.sarif	Adds SARIF fixture for sarif_diff_by_commits integration test.
client/integration-tests/primitives/tools/sarif_diff_by_commits/line_level_classification/before/monitoring-state.json	Adds monitoring-state fixture for test directory completeness.
client/integration-tests/primitives/tools/sarif_diff_by_commits/line_level_classification/after/results.sarif	Adds expected post-state fixture.
client/integration-tests/primitives/tools/sarif_diff_by_commits/line_level_classification/after/monitoring-state.json	Adds expected monitoring-state fixture.
client/integration-tests/primitives/tools/sarif_diff_by_commits/line_level_classification/README.md	Documents the new integration test case.
client/integration-tests/primitives/tools/sarif_diff_by_commits/file_level_classification/test-config.json	Adds Go-runner style integration test config for sarif_diff_by_commits (file).
client/integration-tests/primitives/tools/sarif_diff_by_commits/file_level_classification/before/results.sarif	Adds SARIF fixture for file-level classification test.
client/integration-tests/primitives/tools/sarif_diff_by_commits/file_level_classification/before/monitoring-state.json	Adds monitoring-state fixture.
client/integration-tests/primitives/tools/sarif_diff_by_commits/file_level_classification/after/results.sarif	Adds expected post-state fixture.
client/integration-tests/primitives/tools/sarif_diff_by_commits/file_level_classification/after/monitoring-state.json	Adds expected monitoring-state fixture.
client/integration-tests/primitives/tools/sarif_diff_by_commits/file_level_classification/README.md	Documents the new integration test case.
client/integration-tests/primitives/tools/codeql_test_run/custom_log_directory/test-config.json	Updates logDir usage to {{tmpdir}}-based location.
client/integration-tests/primitives/tools/codeql_query_run/custom_log_directory/test-config.json	Updates logDir usage to {{tmpdir}}-based location.
client/integration-tests/primitives/tools/codeql_query_compile/compile_query/test-config.json	Adds integration test for query compile + DIL file output.
client/integration-tests/primitives/tools/codeql_query_compile/compile_query/before/test_query.ql	Removes unused fixture query file.
client/integration-tests/primitives/tools/codeql_query_compile/compile_query/before/codeql-pack.lock.yml	Removes unused fixture lockfile.
client/integration-tests/primitives/tools/codeql_query_compile/compile_query/after/test_query.ql	Removes unused expected fixture query file.
client/integration-tests/primitives/tools/codeql_bqrs_interpret/sarif_format/after/results.sarif	Updates expected SARIF output fixture content.
client/integration-tests/README.md	Updates integration-test contract to Go runner (test-config.json etc.).
client/go.mod	Introduces Go module for the new client.
client/eslint.config.mjs	Removes JS lint config for the removed JS client.
client/cmd/use_tool.go	Adds use tool command to call a single MCP tool.
client/cmd/use_test.go	Adds tests for use subcommands and arg parsing helpers.
client/cmd/use_resource.go	Adds use resource command to read a resource URI.
client/cmd/use_prompt.go	Adds use prompt command to get a prompt by name.
client/cmd/use.go	Adds use command group and key=value arg parsing helpers.
client/cmd/sarif.go	Adds sarif command group placeholder.
client/cmd/root_test.go	Adds tests for root command help/version/default flags.
client/cmd/root.go	Adds root Cobra command, global flags, and version.
client/cmd/list_test.go	Adds tests ensuring list commands appear in help output.
client/cmd/list.go	Adds list tools/prompts/resources commands (stdio/http).
client/cmd/integration_tests.go	Adds integration-tests command that runs fixtures against MCP server.
client/cmd/helpers_test.go	Adds tests for repo parsing helper.
client/cmd/helpers.go	Adds owner/repo parsing helper.
client/cmd/code_scanning_list_analyses.go	Adds Code Scanning analyses list command (GitHub REST).
client/cmd/code_scanning_list_alerts.go	Adds Code Scanning alerts list command (GitHub REST).
client/cmd/code_scanning_download_analysis.go	Adds analysis SARIF download command.
client/cmd/code_scanning.go	Adds code-scanning command group.
client/README.md	Rewrites client documentation for Go CLI usage and testing.
client/Makefile	Adds build/lint/test/cross-compile targets for Go client.
client/.gitignore	Updates ignore patterns for Go artifacts + legacy JS remnants.
README.md	Updates repo-wide Node minimum version.
CHANGELOG.md	Updates Unreleased notes for Go client + tool/default changes + version bumps.
.node-version	Bumps Node version used by tooling/CI.
.github/workflows/lint-and-format.yml	Adds Go setup step for lint/format workflow.
.github/skills/validate-ql-mcp-server-tools-queries/SKILL.md	Updates workflow reference to renamed CI file.
.github/prompts/ql-mcp-server-fix-build-and-test.prompt.md	Updates instructions to use Go client and new commands.
.github/instructions/client_src_js.instructions.md	Removes JS client instructions.
.github/instructions/client_integration_tests.instructions.md	Updates integration-test instructions for Go client runner.
.github/instructions/client_go.instructions.md	Adds Go client instructions.
.github/agents/ql-mcp-tool-tester.md	Updates agent guidance to use Go client.
.github/agents/ql-mcp-tool-developer.md	Updates developer agent guidance to use Go client.
.github/agents/ql-agent-skills-developer.md	Updates skill developer guide to use Go client list commands.
.github/actions/setup-codeql-environment/action.yml	Updates default Go version for setup action.
.devcontainer/devcontainer.json	Updates devcontainer Node image major version.

Copilot's findings

• Files reviewed: 127/132 changed files
• Comments generated: 8

[Copilot]

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

[Copilot]

Copilot's findings

• Files reviewed: 127/132 changed files
• Comments generated: 0 new